Refrigeration hack hits 700 French supermarkets

Attackers changed refrigeration settings in French supermarkets over the weekend, and managers had to judge which chilled and frozen food was still safe to sell. Economy minister Roland Lescure told the National Assembly on 13 October that about 700 of France's roughly 10,000 food stores had been affected, adding that the attack first raised fears about supply but caused no national shortage (Dailymotion, BFMTV). Cooling in a large supermarket is run by networked controllers, and this week showed what happens when someone else changes their settings.

A store being affected does not mean its food was ruined. Lescure's figure counts stores that were hit, not stores that threw food away. At one Intermarché in Gradignan, a bailiff recorded €21,000 of spoiled stock at purchase cost (Le Monde). We covered the first night of damage (To Brief), and since then the official count has grown and a second brand of equipment has been targeted.

A thermostat panel with a web page

A large store does not run each cabinet like a kitchen fridge. A supervisory controller works like the central thermostat panel of an office building. Technicians use it to watch temperatures and alarms across the whole installation, often through a web page they can open remotely. One of its routine jobs is defrosting, which briefly warms the cooling coils to melt built-up ice.

Retailers say attackers rewrote those defrost settings, with values reported as high as 50°C (BFMTV). That is a number typed into the controller, not a temperature measured inside a yoghurt pot. Once the settings had been tampered with, stores could no longer vouch that their cold chain had held, so food had to be checked and sometimes discarded.

France's national cyber alert team, CERT-FR, confirmed numerous compromises of Danfoss AK-SM and AK-SC controllers. It called the exposure of their management pages directly to the public internet poor practice (CERT-FR). In thermostat terms, that is like mounting the building's control panel on the pavement outside.

Danfoss, the Danish manufacturer, gave its own account. It said most affected units were old models it had retired, one line in 2016 and another in 2021, and that its own networks were untouched (Cooling Post). Investigators have not published how the attackers got in.

The list widened on the night of 12 to 13 October, when stores using controllers from a second maker, Dixell, reported similar tampering (Le Monde). At one supermarket in Gironde, staff spotted the altered settings before anything had to be thrown away. It is not yet clear whether the same attackers are behind the Dixell cases.

Empty shelves in Belgium, for a different reason

A separate incident across the border hit shelves through logistics rather than fridges. On Sunday 11 October, Ahold Delhaize, owner of Albert Heijn and Delhaize, found a security issue in its network and took systems offline as a precaution (Ahold Delhaize). Stores stayed open, but online ordering and delivery went down. Albert Heijn's chief executive said work stopped completely at some of the chain's seven large Dutch distribution centres (NOS).

Belgian Albert Heijn stores depend on one of those centres, in Tilburg (VRT), and Belgian reporting soon showed empty shelves at a store in Roeselare. The timing invites a link to France, but Ahold said it saw no sign of one, and the Dutch National Cyber Security Centre said it "currently sees no reason to assume" one (Security.NL).

The weak spot exposed in France also exists elsewhere. Danish engineering outlet Ingeniøren found 51 older Danfoss refrigeration systems reachable from the public internet in Denmark, though none was reported compromised (Ingeniøren). That is a count of open doors, not of break-ins. CERT-FR warns that resetting an unsupported device that stays publicly reachable leaves it open to compromise again (CERT-FR). Retailers and their refrigeration contractors do not need to wait for the route used in France to be published. A controller that has been taken off the open internet, or replaced, is far harder for an outsider to reach.